CVE-2022-48570

Summary

Crypto++ through 8.4 contains a timing side channel in ECDSA signature generation. Function FixedSizeAllocatorWithCleanup could write to memory outside of the allocation if the allocated memory was not 16-byte aligned. NOTE: this issue exists because the CVE-2019-14318 fix was intentionally removed for functionality reasons.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/weidai11/cryptopp/releases/tag/CRYPTOPP_8_4_0
• https://github.com/weidai11/cryptopp/issues/992

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: yes
  • Technical Impact: partial

References

• https://github.com/weidai11/cryptopp/releases/tag/CRYPTOPP_8_4_0
• https://github.com/weidai11/cryptopp/issues/992

• ←Previous
• Next→